@abelxiaoxing/cadence 1.8.4 → 2.0.0

package/src/artifact-store.ts

@@ -1,213 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import {
-  chmodSync,
-  closeSync,
-  constants,
-  copyFileSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
-import path from "node:path";
-import { syncDirectory } from "./directory-sync.ts";
-
-const SHA256 = /^[a-f0-9]{64}$/u;
-
-export interface ArtifactIdentity {
-  hash: string;
-  bytes: number;
-}
-
-function digest(bytes: Uint8Array): string {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-function requireHash(hash: string): void {
-  if (!SHA256.test(hash)) throw new Error("artifact-hash-invalid");
-}
-
-function ensureDirectory(directory: string): void {
-  const stat = lstatSync(directory, { throwIfNoEntry: false });
-  if (stat) {
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-      throw new Error("artifact-store-path-unsafe");
-    }
-    chmodSync(directory, 0o700);
-    return;
-  }
-  let cursor = path.dirname(directory);
-  while (cursor !== path.dirname(cursor)) {
-    const ancestor = lstatSync(cursor, { throwIfNoEntry: false });
-    if (ancestor) {
-      if (ancestor.isSymbolicLink() || !ancestor.isDirectory()) {
-        throw new Error("artifact-store-path-unsafe");
-      }
-      break;
-    }
-    cursor = path.dirname(cursor);
-  }
-  mkdirSync(directory, { recursive: true, mode: 0o700 });
-  const created = lstatSync(directory);
-  if (created.isSymbolicLink() || !created.isDirectory()) {
-    throw new Error("artifact-store-path-unsafe");
-  }
-  chmodSync(directory, 0o700);
-}
-
-function writeAtomic(target: string, bytes: Uint8Array): void {
-  const directory = path.dirname(target);
-  ensureDirectory(directory);
-  const temporary = path.join(
-    directory,
-    `.${path.basename(target)}.${process.pid}.${randomUUID()}.tmp`,
-  );
-  const descriptor = openSync(
-    temporary,
-    constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY,
-    0o600,
-  );
-  try {
-    writeFileSync(descriptor, bytes);
-    fsyncSync(descriptor);
-  } finally {
-    closeSync(descriptor);
-  }
-  try {
-    renameSync(temporary, target);
-    chmodSync(target, 0o600);
-    syncDirectory(directory);
-  } catch (error) {
-    try {
-      unlinkSync(temporary);
-    } catch {
-      // The rename may already have consumed the temporary file.
-    }
-    throw error;
-  }
-}
-
-/** Durable content-addressed bytes used by workspace revisions and sealed results. */
-export class ArtifactStore {
-  readonly root: string;
-  readonly #blobs: string;
-  readonly #references: string;
-
-  constructor(root: string) {
-    if (!path.isAbsolute(root)) throw new Error("artifact-store-root-invalid");
-    this.root = path.resolve(root);
-    this.#blobs = path.join(this.root, "blobs");
-    this.#references = path.join(this.root, "references");
-    ensureDirectory(this.root);
-    ensureDirectory(this.#blobs);
-    ensureDirectory(this.#references);
-  }
-
-  #blobPath(hash: string): string {
-    requireHash(hash);
-    return path.join(this.#blobs, hash.slice(0, 2), hash);
-  }
-
-  #referencePath(hash: string): string {
-    requireHash(hash);
-    return path.join(this.#references, hash.slice(0, 2), `${hash}.ref`);
-  }
-
-  put(input: Uint8Array): ArtifactIdentity {
-    if (!(input instanceof Uint8Array))
-      throw new Error("artifact-bytes-invalid");
-    const bytes = Buffer.from(input);
-    const hash = digest(bytes);
-    const target = this.#blobPath(hash);
-    const existing = lstatSync(target, { throwIfNoEntry: false });
-    if (existing) {
-      if (existing.isSymbolicLink() || !existing.isFile()) {
-        throw new Error("artifact-store-path-unsafe");
-      }
-      const current = readFileSync(target);
-      if (current.length !== bytes.length || digest(current) !== hash) {
-        throw new Error("artifact-integrity-invalid");
-      }
-    } else {
-      writeAtomic(target, bytes);
-      const stored = readFileSync(target);
-      if (stored.length !== bytes.length || digest(stored) !== hash) {
-        throw new Error("artifact-integrity-invalid");
-      }
-    }
-    return Object.freeze({ hash, bytes: bytes.length });
-  }
-
-  read(hash: string): Uint8Array {
-    const target = this.#blobPath(hash);
-    const stat = lstatSync(target, { throwIfNoEntry: false });
-    if (!stat?.isFile() || stat.isSymbolicLink()) {
-      throw new Error("artifact-unavailable");
-    }
-    const bytes = readFileSync(target);
-    if (digest(bytes) !== hash) throw new Error("artifact-integrity-invalid");
-    return Buffer.from(bytes);
-  }
-
-  /** Clone when supported; always use a distinct inode and verify the copied bytes. */
-  copyVerified(hash: string, destination: string): number {
-    const source = this.#blobPath(hash);
-    const stat = lstatSync(source, { throwIfNoEntry: false });
-    if (!stat?.isFile() || stat.isSymbolicLink())
-      throw new Error("artifact-unavailable");
-    copyFileSync(
-      source,
-      destination,
-      constants.COPYFILE_EXCL | constants.COPYFILE_FICLONE,
-    );
-    const bytes = readFileSync(destination);
-    if (digest(bytes) !== hash) throw new Error("artifact-integrity-invalid");
-    return bytes.byteLength;
-  }
-
-  referenceCount(hash: string): number {
-    requireHash(hash);
-    const referencePath = this.#referencePath(hash);
-    const stat = lstatSync(referencePath, { throwIfNoEntry: false });
-    if (!stat) return 0;
-    if (!stat.isFile() || stat.isSymbolicLink()) {
-      throw new Error("artifact-reference-invalid");
-    }
-    const raw = readFileSync(referencePath, "utf8");
-    if (!/^(?:0|[1-9][0-9]*)\n$/u.test(raw)) {
-      throw new Error("artifact-reference-invalid");
-    }
-    const count = Number(raw.trim());
-    if (!Number.isSafeInteger(count))
-      throw new Error("artifact-reference-invalid");
-    return count;
-  }
-
-  #setReferenceCount(hash: string, count: number): number {
-    if (!Number.isSafeInteger(count) || count < 0) {
-      throw new Error("artifact-reference-invalid");
-    }
-    writeAtomic(this.#referencePath(hash), Buffer.from(`${count}\n`));
-    return count;
-  }
-
-  retain(hash: string): number {
-    this.read(hash);
-    const current = this.referenceCount(hash);
-    if (current === Number.MAX_SAFE_INTEGER) {
-      throw new Error("artifact-reference-overflow");
-    }
-    return this.#setReferenceCount(hash, current + 1);
-  }
-
-  release(hash: string): number {
-    this.read(hash);
-    const current = this.referenceCount(hash);
-    if (current === 0) throw new Error("artifact-reference-underflow");
-    return this.#setReferenceCount(hash, current - 1);
-  }
-}

package/src/build-windows-job.mjs

@@ -1,95 +0,0 @@
-// Explicit operator/release build only. Never invoked on import, install or verification.
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-function main() {
-  const args = process.argv.slice(2);
-  if (
-    process.platform !== "win32" ||
-    process.arch !== "x64" ||
-    args.length !== 2 ||
-    args[0] !== "--output"
-  )
-    throw new Error(
-      "Windows x64 required; usage: node build-windows-job.mjs --output <directory>",
-    );
-  const output = path.resolve(args[1]);
-  const compiler = path.join(
-    process.env.VCToolsInstallDir ?? "",
-    "bin/Hostx64/x64/cl.exe",
-  );
-  if (!path.isAbsolute(compiler))
-    throw new Error(
-      "Select the installed MSVC x64 developer environment first",
-    );
-  const sdkVersion = process.env.WindowsSDKVersion?.replace(/[\\/]+$/u, "");
-  if (!sdkVersion || !/^10\.0\.\d+\.0$/u.test(sdkVersion))
-    throw new Error("Windows 10 SDK required");
-  const version = spawnSync(compiler, [], {
-    shell: false,
-    encoding: "utf8",
-    timeout: 10000,
-    maxBuffer: 16384,
-  });
-  const compilerVersion =
-    `${version.stdout ?? ""}${version.stderr ?? ""}`.match(
-      /19\.(?:3\d|4\d)\.\d+/u,
-    )?.[0];
-  if (!compilerVersion) throw new Error("MSVC 19.3x/19.4x required");
-  mkdirSync(output, { recursive: true });
-  const source = fileURLToPath(new URL("./windows-job.c", import.meta.url));
-  const helper = path.join(output, "windows-job.exe");
-  rmSync(`${helper}.json`, { force: true });
-  rmSync(helper, { force: true });
-  const result = spawnSync(
-    compiler,
-    [
-      "/nologo",
-      "/W4",
-      "/WX",
-      "/O2",
-      "/MT",
-      "/utf-8",
-      "/DUNICODE",
-      "/D_UNICODE",
-      source,
-      `/Fe:${helper}`,
-      `/Fo:${path.join(output, "windows-job.obj")}`,
-    ],
-    {
-      shell: false,
-      cwd: output,
-      encoding: "utf8",
-      timeout: 60000,
-      maxBuffer: 65536,
-    },
-  );
-  writeFileSync(
-    path.join(output, "build.log"),
-    `${result.stdout ?? ""}${result.stderr ?? ""}`,
-  );
-  if (result.error || result.status !== 0)
-    throw new Error("Native build failed; inspect build.log");
-  const hash = (file) =>
-    createHash("sha256").update(readFileSync(file)).digest("hex");
-  writeFileSync(
-    `${helper}.json`,
-    `${JSON.stringify({ version: 2, arch: "x64", sourceSha256: hash(source), helperSha256: hash(helper), compilerSha256: hash(compiler), compilerVersion, sdkVersion }, null, 2)}\n`,
-    { flag: "wx" },
-  );
-  console.log(`Built ${helper}`);
-}
-if (
-  process.argv[1] &&
-  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
-) {
-  try {
-    main();
-  } catch (error) {
-    console.error(error.message);
-    process.exitCode = 1;
-  }
-}

package/src/candidate-artifact.ts

@@ -1,143 +0,0 @@
-import { createHash } from "node:crypto";
-import { diffWritePaths } from "./contracts.ts";
-import {
-  type BeginCandidateInput,
-  TASK_LEDGER_LIMITS,
-  type TaskLedger,
-} from "./task-ledger.ts";
-import type { DurableCandidateProposal } from "./workflow-policy.ts";
-
-type ArtifactProposal = Extract<
-  DurableCandidateProposal,
-  { kind: "candidate" | "sealed-candidate" }
->;
-interface CandidateArtifactInput {
-  ledger: TaskLedger;
-  identity: BeginCandidateInput;
-  proposal: ArtifactProposal;
-}
-
-const sha256 = (bytes: Uint8Array) =>
-  createHash("sha256").update(bytes).digest("hex");
-
-/** Inspect the same sealed bytes for normal phases and repairs. Callers own recovery policy. */
-export function inspectCandidateArtifact({
-  ledger,
-  identity,
-  proposal,
-  approvedPaths,
-}: CandidateArtifactInput & { approvedPaths: readonly string[] }):
-  | { ok: true; bytes: Buffer; paths: string[] }
-  | {
-      ok: false;
-      code: "candidate-diff-invalid" | "write-set-mismatch";
-      stage: string;
-    } {
-  const invalid = (stage: string) => ({
-    ok: false as const,
-    code: "candidate-diff-invalid" as const,
-    stage,
-  });
-  ledger.beginCandidate(identity);
-  let bytes: Buffer;
-  if (proposal.kind === "sealed-candidate") {
-    if (
-      proposal.candidateId !== identity.candidateId ||
-      !/^[a-f0-9]{64}$/u.test(proposal.artifactHash) ||
-      !Number.isSafeInteger(proposal.bytes) ||
-      proposal.bytes < 1 ||
-      !Array.isArray(proposal.paths)
-    )
-      return invalid("candidate-seal");
-    bytes = Buffer.from(ledger.readSealedCandidate(identity.candidateId));
-    if (
-      bytes.length !== proposal.bytes ||
-      sha256(bytes) !== proposal.artifactHash
-    ) {
-      throw new Error("candidate-seal-integrity-invalid");
-    }
-  } else {
-    if (
-      !(proposal.bytes instanceof Uint8Array) ||
-      proposal.bytes.length === 0
-    ) {
-      return invalid("candidate-submit");
-    }
-    bytes = Buffer.from(proposal.bytes);
-  }
-  let paths: string[];
-  try {
-    paths = diffWritePaths(
-      new TextDecoder("utf-8", { fatal: true }).decode(bytes),
-    ).paths;
-  } catch {
-    return invalid("candidate-diff");
-  }
-  if (paths.some((relative) => !approvedPaths.includes(relative))) {
-    return {
-      ok: false,
-      code: "write-set-mismatch",
-      stage: "candidate-boundary",
-    };
-  }
-  if (
-    proposal.kind === "sealed-candidate" &&
-    JSON.stringify([...proposal.paths].sort()) !==
-      JSON.stringify([...paths].sort())
-  ) {
-    return invalid("candidate-seal");
-  }
-  return { ok: true, bytes, paths };
-}
-
-/** Seal after isolated patch/dependency checks, before any phase verification. */
-export function sealCandidateArtifact({
-  ledger,
-  identity,
-  proposal,
-  bytes,
-}: CandidateArtifactInput & { bytes: Buffer }):
-  | { ok: true; artifactHash: string }
-  | { ok: false; kind: "paused" | "retryable"; code: string; stage: string } {
-  if (proposal.kind === "sealed-candidate")
-    return { ok: true, artifactHash: proposal.artifactHash };
-  let sequence = 0;
-  for (
-    let offset = 0;
-    offset < bytes.length;
-    offset += TASK_LEDGER_LIMITS.maxSegmentBytes
-  ) {
-    const segment = bytes.subarray(
-      offset,
-      Math.min(offset + TASK_LEDGER_LIMITS.maxSegmentBytes, bytes.length),
-    );
-    const accepted = ledger.appendCandidateSegment({
-      ...identity,
-      sequence,
-      bytes: segment,
-      segmentHash: sha256(segment),
-    });
-    if (!accepted.ok)
-      return {
-        ok: false,
-        kind: "paused",
-        code: accepted.code,
-        stage: "candidate-segment",
-      };
-    sequence++;
-  }
-  const sealed = ledger.sealCandidate({
-    ...identity,
-    segmentCount: sequence,
-    totalBytes: bytes.length,
-    candidateHash: sha256(bytes),
-  });
-  return sealed.ok
-    ? { ok: true, artifactHash: sealed.artifactHash }
-    : {
-        ok: false,
-        kind: "retryable",
-        code: sealed.code,
-        stage: "candidate-seal",
-      };
-}